[
https://issues.apache.org/jira/browse/JXPATH-206?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tim Scheckenbach updated JXPATH-206:
------------------------------------
Description:
We found an issue in the fuzzing infrastructure belonging to Apache Commons
JXPath on OSS-Fuzz. See:
https://github.com/google/oss-fuzz/tree/cf22c9f69badb6a4e064f7a01eeadbefdfc9fd7a/projects/apache-commons-jxpath
{{JXPathFuzzer}} parses the input itself, before JXPath is involved:
{code:java}
doc = builder.parse(new InputSource(new
StringReader(data.consumeString(2000))));
{code}
The {{DocumentBuilderFactory}} above it is unconfigured, so a DOCTYPE in the
input makes the parser open the file or URL it names.
The seed corpus shipped with the fuzzer contains XHTML doctypes, multiple files
mention {{www.w3.org}}, and a plain run would contact that host and stop with
this error:
{code}
$ python3 infra/helper.py run_fuzzer apache-commons-jxpath JXPathFuzzer --
-runs=3000
== Java Exception: com.code_intelligence.jazzer.api.FuzzerSecurityIssueMedium:
Server Side Request Forgery (SSRF)
Attempted connection to: www.w3.org:80
{code}
h2. Patch
{code:java}
factory.setFeature("http://xml.org/sax/features/external-general-entities";,
false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities";,
false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd";,
false);
factory.setXIncludeAware(false);
{code}
The same run then finishes.
It also fixes the two open testcases, attached.
These two crashes are related to this issue that is marked as fixed but still
exists (https://issues.oss-fuzz.com/issues/42525841).
Both stack traces end at {{JXPathFuzzer.java:48}} inside the JDK's XML parser.
So they crash before any JXPath code would be executed:
Download the attached Archive.zip and unzip the crash reports contained in it.
{code}
export DOCKER_DEFAULT_PLATFORM=linux/amd64 # if on mac
git clone https://github.com/google/oss-fuzz.git
cd oss-fuzz
python3 infra/helper.py build_image apache-commons-jxpath
python3 infra/helper.py build_fuzzers --sanitizer address apache-commons-jxpath
cp <unzipped Archive.zip crashes> .
python3 infra/helper.py reproduce apache-commons-jxpath JXPathFuzzer
crash-063b9cde5d2bb9ecf27962e885b4da22756bb642
python3 infra/helper.py reproduce apache-commons-jxpath JXPathFuzzer
crash-00aa313fb7828be750fc6c4372b976283e6f125e
{code}
Found by the CISPA Fandango-Team while triaging OSS-Fuzz findings for
apache-commons-jxpath.
was:
{{JXPathFuzzer}} parses the input itself, before JXPath is involved:
{code:java}
doc = builder.parse(new InputSource(new
StringReader(data.consumeString(2000))));
{code}
The {{DocumentBuilderFactory}} above it is unconfigured, so a DOCTYPE in the
input makes the parser open the file or URL it names.
The seed corpus shipped with the fuzzer contains XHTML doctypes, multiple files
mention {{www.w3.org}}, and a plain run would contact that host and stop with
this error:
{code}
$ python3 infra/helper.py run_fuzzer apache-commons-jxpath JXPathFuzzer --
-runs=3000
== Java Exception: com.code_intelligence.jazzer.api.FuzzerSecurityIssueMedium:
Server Side Request Forgery (SSRF)
Attempted connection to: www.w3.org:80
{code}
h2. Patch
{code:java}
factory.setFeature("http://xml.org/sax/features/external-general-entities";,
false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities";,
false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd";,
false);
factory.setXIncludeAware(false);
{code}
The same run then finishes.
It also fixes the two open testcases, attached.
These two crashes are related to this issue that is marked as fixed but still
exists (https://issues.oss-fuzz.com/issues/42525841).
Both stack traces end at {{JXPathFuzzer.java:48}} inside the JDK's XML parser.
So they crash before any JXPath code would be executed:
Download the attached Archive.zip and unzip the crash reports contained in it.
{code}
export DOCKER_DEFAULT_PLATFORM=linux/amd64 # if on mac
git clone https://github.com/google/oss-fuzz.git
cd oss-fuzz
python3 infra/helper.py build_image apache-commons-jxpath
python3 infra/helper.py build_fuzzers --sanitizer address apache-commons-jxpath
cp <unzipped Archive.zip crashes> .
python3 infra/helper.py reproduce apache-commons-jxpath JXPathFuzzer
crash-063b9cde5d2bb9ecf27962e885b4da22756bb642
python3 infra/helper.py reproduce apache-commons-jxpath JXPathFuzzer
crash-00aa313fb7828be750fc6c4372b976283e6f125e
{code}
Found by the CISPA Fandango-Team while triaging OSS-Fuzz findings for
apache-commons-jxpath.
> apache-commons-jxpath: stop JXPathFuzzer from reading files and opening
> connections
> -----------------------------------------------------------------------------------
>
> Key: JXPATH-206
> URL: https://issues.apache.org/jira/browse/JXPATH-206
> Project: Commons JXPath
> Issue Type: Bug
> Affects Versions: 1.4.0
> Reporter: Tim Scheckenbach
> Priority: Major
> Attachments: Archive.zip
>
>
> We found an issue in the fuzzing infrastructure belonging to Apache Commons
> JXPath on OSS-Fuzz. See:
> https://github.com/google/oss-fuzz/tree/cf22c9f69badb6a4e064f7a01eeadbefdfc9fd7a/projects/apache-commons-jxpath
>
> {{JXPathFuzzer}} parses the input itself, before JXPath is involved:
> {code:java}
> doc = builder.parse(new InputSource(new
> StringReader(data.consumeString(2000))));
> {code}
> The {{DocumentBuilderFactory}} above it is unconfigured, so a DOCTYPE in the
> input makes the parser open the file or URL it names.
> The seed corpus shipped with the fuzzer contains XHTML doctypes, multiple
> files mention {{www.w3.org}}, and a plain run would contact that host and
> stop with this error:
> {code}
> $ python3 infra/helper.py run_fuzzer apache-commons-jxpath JXPathFuzzer --
> -runs=3000
> == Java Exception:
> com.code_intelligence.jazzer.api.FuzzerSecurityIssueMedium: Server Side
> Request Forgery (SSRF)
> Attempted connection to: www.w3.org:80
> {code}
> h2. Patch
> {code:java}
> factory.setFeature("http://xml.org/sax/features/external-general-entities";,
> false);
> factory.setFeature("http://xml.org/sax/features/external-parameter-entities";,
> false);
> factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd";,
> false);
> factory.setXIncludeAware(false);
> {code}
> The same run then finishes.
> It also fixes the two open testcases, attached.
> These two crashes are related to this issue that is marked as fixed but still
> exists (https://issues.oss-fuzz.com/issues/42525841).
> Both stack traces end at {{JXPathFuzzer.java:48}} inside the JDK's XML
> parser. So they crash before any JXPath code would be executed:
> Download the attached Archive.zip and unzip the crash reports contained in it.
> {code}
> export DOCKER_DEFAULT_PLATFORM=linux/amd64 # if on mac
> git clone https://github.com/google/oss-fuzz.git
> cd oss-fuzz
> python3 infra/helper.py build_image apache-commons-jxpath
> python3 infra/helper.py build_fuzzers --sanitizer address
> apache-commons-jxpath
> cp <unzipped Archive.zip crashes> .
> python3 infra/helper.py reproduce apache-commons-jxpath JXPathFuzzer
> crash-063b9cde5d2bb9ecf27962e885b4da22756bb642
> python3 infra/helper.py reproduce apache-commons-jxpath JXPathFuzzer
> crash-00aa313fb7828be750fc6c4372b976283e6f125e
> {code}
> Found by the CISPA Fandango-Team while triaging OSS-Fuzz findings for
> apache-commons-jxpath.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
